brakeman 5.2.2 → 7.1.1

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler/children_compiler.rb

@@ -0,0 +1,155 @@
+# frozen_string_literal: true
+require 'haml/temple_line_counter'
+
+module Haml
+  class Compiler
+    class ChildrenCompiler
+      def initialize
+        @lineno = 1
+        @multi_flattener = Temple::Filters::MultiFlattener.new
+      end
+
+      def compile(node, &block)
+        temple = [:multi]
+        return temple if node.children.empty?
+
+        temple << [:whitespace] if prepend_whitespace?(node)
+        node.children.each do |n|
+          rstrip_whitespace!(temple) if nuke_prev_whitespace?(n)
+          insert_newlines!(temple, n)
+          temple << moving_lineno(n) { block.call(n) }
+          temple << [:whitespace] if insert_whitespace?(n)
+        end
+        rstrip_whitespace!(temple) if nuke_inner_whitespace?(node)
+        temple
+      end
+
+      private
+
+      def insert_newlines!(temple, node)
+        (node.line - @lineno).times do
+          temple << [:newline]
+        end
+
+        @lineno = node.line
+      end
+
+      def moving_lineno(node, &block)
+        # before: As they may have children, we need to increment lineno before compilation.
+        case node.type
+        when :script, :silent_script
+          @lineno += 1
+        when :tag
+          [node.value[:dynamic_attributes].new, node.value[:dynamic_attributes].old].compact.each do |attribute_hash|
+            @lineno += attribute_hash.count("\n")
+          end
+          @lineno += 1 if node.children.empty? && node.value[:parse]
+        end
+
+        temple = block.call # compile
+
+        # after: filter may not have children, and for some dynamic filters we can't predict the number of lines.
+        case node.type
+        when :filter
+          @lineno += TempleLineCounter.count_lines(temple)
+        end
+
+        temple
+      end
+
+      def prepend_whitespace?(node)
+        return false unless %i[comment tag].include?(node.type)
+        !nuke_inner_whitespace?(node)
+      end
+
+      def nuke_inner_whitespace?(node)
+        case
+        when node.type == :tag
+          node.value[:nuke_inner_whitespace]
+        when node.parent.nil?
+          false
+        else
+          nuke_inner_whitespace?(node.parent)
+        end
+      end
+
+      def nuke_prev_whitespace?(node)
+        case node.type
+        when :tag
+          node.value[:nuke_outer_whitespace]
+        when :silent_script
+          !node.children.empty? && nuke_prev_whitespace?(node.children.first)
+        else
+          false
+        end
+      end
+
+      def nuke_outer_whitespace?(node)
+        return false if node.type != :tag
+        node.value[:nuke_outer_whitespace]
+      end
+
+      def rstrip_whitespace!(temple)
+        return if temple.size == 1
+
+        case temple[0]
+        when :multi
+          case temple[-1][0]
+          when :whitespace
+            temple.delete_at(-1)
+          when :multi, :block
+            rstrip_whitespace!(temple[-1])
+          end
+        when :block
+          _block, code, exp = temple
+          if code.start_with?(/\s*if\s/)
+            # Remove [:whitespace] before `end`
+            exp.replace(@multi_flattener.call(exp))
+            rstrip_whitespace!(exp)
+
+            # Remove [:whitespace] before `else` if exists
+            else_index = find_else_index(exp)
+            if else_index
+              whitespace_index = else_index - 1
+              while exp[whitespace_index] == [:newline]
+                whitespace_index -= 1
+              end
+              if exp[whitespace_index] == [:whitespace]
+                exp.delete_at(whitespace_index)
+              end
+            end
+          end
+        end
+      end
+
+      def find_else_index(temple)
+        multi, *args = temple
+        return nil if multi != :multi
+
+        args.each_with_index do |arg, index|
+          if arg[0] == :code && arg[1].match?(/\A\s*else\s*\z/)
+            return index + 1
+          end
+        end
+        nil
+      end
+
+      def insert_whitespace?(node)
+        return false if nuke_outer_whitespace?(node)
+
+        case node.type
+        when :doctype
+          node.value[:type] != 'xml'
+        when :comment, :plain, :tag
+          true
+        when :script
+          node.children.empty? && !nuke_inner_whitespace?(node)
+        when :filter
+          !%w[ruby].include?(node.value[:name])
+        else
+          false
+        end
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler/comment_compiler.rb

@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+module Haml
+  class Compiler
+    class CommentCompiler
+      def compile(node, &block)
+        if node.value[:conditional]
+          compile_conditional_comment(node, &block)
+        else
+          compile_html_comment(node, &block)
+        end
+      end
+
+      private
+
+      def compile_html_comment(node, &block)
+        if node.children.empty?
+          [:html, :comment, compile_text(node)]
+        else
+          [:html, :comment, yield(node)]
+        end
+      end
+
+      def compile_conditional_comment(node, &block)
+        condition = node.value[:conditional]
+        if node.value[:conditional] =~ /\A\[(\[*[^\[\]]+\]*)\]/
+          condition = $1
+        end
+
+        content =
+          if node.children.empty?
+            compile_text(node)
+          else
+            yield(node)
+          end
+        [:html, :condcomment, condition, content, node.value[:revealed]]
+      end
+
+      def compile_text(node)
+        text =
+          if node.value[:parse]
+            # Just always escaping the result for safety. We could respect
+            # escape_html, but I don't see any use case for it.
+            [:escape, true, [:dynamic, node.value[:text]]]
+          else
+            [:static, node.value[:text]]
+          end
+        [:multi, [:static, ' '], text, [:static, ' ']]
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler/doctype_compiler.rb

@@ -0,0 +1,52 @@
+# frozen_string_literal: true
+module Haml
+  class Compiler
+    class DoctypeCompiler
+      def initialize(options = {})
+        @format = options[:format]
+      end
+
+      def compile(node)
+        case node.value[:type]
+        when ''
+          html_doctype(node)
+        when 'xml'
+          xml_doctype
+        when 'rdfa'
+          rdfa_doctype
+        else
+          [:html, :doctype, node.value[:type]]
+        end
+      end
+
+      private
+
+      def html_doctype(node)
+        version = node.value[:version] || :transitional
+        case @format
+        when :xhtml
+          [:html, :doctype, version]
+        when :html4
+          [:html, :doctype, :transitional]
+        when :html5
+          [:html, :doctype, :html]
+        else
+          [:html, :doctype, @format]
+        end
+      end
+
+      def xml_doctype
+        case @format
+        when :xhtml
+          [:static, "<?xml version='1.0' encoding='utf-8' ?>\n"]
+        else
+          [:multi]
+        end
+      end
+
+      def rdfa_doctype
+        [:static, '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML+RDFa 1.0//EN" "http://www.w3.org/MarkUp/DTD/xhtml-rdfa-1.dtd">']
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler/script_compiler.rb

@@ -0,0 +1,114 @@
+# frozen_string_literal: true
+require 'temple/static_analyzer'
+require 'haml/ruby_expression'
+require 'haml/string_splitter'
+
+module Haml
+  class Compiler
+    class ScriptCompiler
+      def self.find_and_preserve(input, tags)
+        tags = tags.map { |tag| Regexp.escape(tag) }.join('|')
+        re = /<(#{tags})([^>]*)>(.*?)(<\/\1>)/im
+        input.to_s.gsub(re) do |s|
+          s =~ re # Can't rely on $1, etc. existing since Rails' SafeBuffer#gsub is incompatible
+          "<#{$1}#{$2}>#{Haml::Helpers.preserve($3)}</#{$1}>"
+        end
+      end
+
+      def initialize(identity, options)
+        @identity = identity
+        @disable_capture = options[:disable_capture]
+      end
+
+      def compile(node, &block)
+        unless Ripper.respond_to?(:lex) # No Ripper.lex in truffleruby
+          return dynamic_compile(node, &block)
+        end
+
+        no_children = node.children.empty?
+        case
+        when no_children && node.value[:escape_interpolation]
+          compile_interpolated_plain(node)
+        when no_children && RubyExpression.string_literal?(node.value[:text])
+          delegate_optimization(node)
+        when no_children && Temple::StaticAnalyzer.static?(node.value[:text])
+          static_compile(node)
+        else
+          dynamic_compile(node, &block)
+        end
+      end
+
+      private
+
+      # String-interpolated plain text must be compiled with this method
+      # because we have to escape only interpolated values.
+      def compile_interpolated_plain(node)
+        temple = [:multi]
+        StringSplitter.compile(node.value[:text]).each do |type, value|
+          case type
+          when :static
+            temple << [:static, value]
+          when :dynamic
+            temple << [:escape, node.value[:escape_interpolation], [:dynamic, value]]
+          end
+        end
+        temple << [:newline]
+      end
+
+      # :dynamic is optimized in other filter: StringSplitter
+      def delegate_optimization(node)
+        [:multi,
+         [:escape, node.value[:escape_html], [:dynamic, node.value[:text]]],
+         [:newline],
+        ]
+      end
+
+      def static_compile(node)
+        str = eval(node.value[:text]).to_s
+        if node.value[:escape_html]
+          str = Haml::Util.escape_html(str)
+        elsif node.value[:preserve]
+          str = ScriptCompiler.find_and_preserve(str, %w(textarea pre code))
+        end
+        [:multi, [:static, str], [:newline]]
+      end
+
+      def dynamic_compile(node, &block)
+        var = @identity.generate
+        temple = compile_script_assign(var, node, &block)
+        temple << compile_script_result(var, node)
+      end
+
+      def compile_script_assign(var, node, &block)
+        if node.children.empty?
+          [:multi,
+           [:code, "#{var} = (#{node.value[:text]}"],
+           [:newline],
+           [:code, ')'],
+          ]
+        else
+          [:multi,
+           [:block, "#{var} = #{node.value[:text]}",
+            [:multi, [:newline], @disable_capture ? yield(node) : [:capture, Temple::Utils.unique_name, yield(node)]]
+           ],
+          ]
+        end
+      end
+
+      def compile_script_result(result, node)
+        if !node.value[:escape_html] && node.value[:preserve]
+          result = find_and_preserve(result)
+        end
+        [:escapeany, node.value[:escape_html], [:dynamic, result]]
+      end
+
+      def find_and_preserve(code)
+        %Q[::Haml::Compiler::ScriptCompiler.find_and_preserve(#{code}, %w(textarea pre code))]
+      end
+
+      def escape_html(temple)
+        [:escape, true, temple]
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler/silent_script_compiler.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+module Haml
+  class Compiler
+    class SilentScriptCompiler
+      def compile(node, &block)
+        if node.children.empty?
+          [:multi, [:code, node.value[:text]], [:newline]]
+        else
+          compile_with_children(node, &block)
+        end
+      end
+
+      private
+
+      def compile_with_children(node, &block)
+        [:multi,
+         [:block, node.value[:text],
+          [:multi, [:newline], yield(node)],
+         ],
+        ]
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler/tag_compiler.rb

@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+require 'haml/util'
+require 'haml/attribute_compiler'
+require 'haml/string_splitter'
+
+module Haml
+  class Compiler
+    class TagCompiler
+      def initialize(identity, options)
+        @autoclose = options[:autoclose]
+        @identity  = identity
+        @attribute_compiler = AttributeCompiler.new(identity, options)
+      end
+
+      def compile(node, &block)
+        attrs    = @attribute_compiler.compile(node)
+        contents = compile_contents(node, &block)
+        [:html, :tag, node.value[:name], attrs, contents]
+      end
+
+      private
+
+      def compile_contents(node, &block)
+        case
+        when !node.children.empty?
+          yield(node)
+        when node.value[:value].nil? && self_closing?(node)
+          nil
+        when node.value[:parse]
+          return compile_interpolated_plain(node) if node.value[:escape_interpolation]
+          if Ripper.respond_to?(:lex) # No Ripper.lex in truffleruby
+            return delegate_optimization(node) if RubyExpression.string_literal?(node.value[:value])
+            return delegate_optimization(node) if Temple::StaticAnalyzer.static?(node.value[:value])
+          end
+
+          var = @identity.generate
+          [:multi,
+           [:code, "#{var} = (#{node.value[:value]}"],
+           [:newline],
+           [:code, ')'],
+           [:escape, node.value[:escape_html], [:dynamic, var]]
+          ]
+        else
+          [:static, node.value[:value]]
+        end
+      end
+
+      # :dynamic is optimized in other filters: StringSplitter or StaticAnalyzer
+      def delegate_optimization(node)
+        [:multi,
+         [:escape, node.value[:escape_html], [:dynamic, node.value[:value]]],
+         [:newline],
+        ]
+      end
+
+      # We should handle interpolation here to escape only interpolated values.
+      def compile_interpolated_plain(node)
+        temple = [:multi]
+        StringSplitter.compile(node.value[:value]).each do |type, value|
+          case type
+          when :static
+            temple << [:static, value]
+          when :dynamic
+            temple << [:escape, node.value[:escape_interpolation], [:dynamic, value]]
+          end
+        end
+        temple << [:newline]
+      end
+
+      def self_closing?(node)
+        return true if @autoclose && @autoclose.include?(node.value[:name])
+        node.value[:self_closing]
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/compiler.rb

@@ -0,0 +1,97 @@
+# frozen_string_literal: true
+require 'haml/compiler/children_compiler'
+require 'haml/compiler/comment_compiler'
+require 'haml/compiler/doctype_compiler'
+require 'haml/compiler/script_compiler'
+require 'haml/compiler/silent_script_compiler'
+require 'haml/compiler/tag_compiler'
+require 'haml/filters'
+require 'haml/identity'
+
+module Haml
+  class Compiler
+    def initialize(options = {})
+      identity                = Identity.new
+      @children_compiler      = ChildrenCompiler.new
+      @comment_compiler       = CommentCompiler.new
+      @doctype_compiler       = DoctypeCompiler.new(options)
+      @filter_compiler        = Filters.new(options)
+      @script_compiler        = ScriptCompiler.new(identity, options)
+      @silent_script_compiler = SilentScriptCompiler.new
+      @tag_compiler           = TagCompiler.new(identity, options)
+    end
+
+    def call(ast)
+      return runtime_error(ast) if ast.is_a?(Error)
+      compile(ast)
+    rescue Error => e
+      runtime_error(e)
+    end
+
+    private
+
+    def compile(node)
+      case node.type
+      when :root
+        compile_children(node)
+      when :comment
+        compile_comment(node)
+      when :doctype
+        compile_doctype(node)
+      when :filter
+        compile_filter(node)
+      when :plain
+        compile_plain(node)
+      when :script
+        compile_script(node)
+      when :silent_script
+        compile_silent_script(node)
+      when :tag
+        compile_tag(node)
+      when :haml_comment
+        [:multi]
+      else
+        raise InternalError.new("Unexpected node type: #{node.type}")
+      end
+    end
+
+    def compile_children(node)
+      @children_compiler.compile(node) { |n| compile(n) }
+    end
+
+    def compile_comment(node)
+      @comment_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def compile_doctype(node)
+      @doctype_compiler.compile(node)
+    end
+
+    def compile_filter(node)
+      @filter_compiler.compile(node)
+    end
+
+    def compile_plain(node)
+      [:static, node.value[:text]]
+    end
+
+    def compile_script(node)
+      @script_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def compile_silent_script(node)
+      @silent_script_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def compile_tag(node)
+      @tag_compiler.compile(node) { |n| compile_children(n) }
+    end
+
+    def runtime_error(error)
+      [:multi].tap do |temple|
+        error.line.times { temple << [:newline] } if error.line
+        temple << [:code, %Q[raise #{error.class}.new(%q[#{error.message}], #{error.line.inspect})]]
+      end
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/dynamic_merger.rb

@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+module Haml
+  # Compile [:multi, [:static, 'foo'], [:dynamic, 'bar']] to [:dynamic, '"foo#{bar}"']
+  class DynamicMerger < Temple::Filter
+    def on_multi(*exps)
+      exps = exps.dup
+      result = [:multi]
+      buffer = []
+
+      until exps.empty?
+        type, arg = exps.first
+        if type == :dynamic && arg.count("\n") == 0
+          buffer << exps.shift
+        elsif type == :static && exps.size > (count = arg.count("\n")) &&
+              exps[1, count].all? { |e| e == [:newline] }
+          (1 + count).times { buffer << exps.shift }
+        elsif type == :newline && exps.size > (count = count_newline(exps)) &&
+              exps[count].first == :static && count == exps[count].last.count("\n")
+          (count + 1).times { buffer << exps.shift }
+        else
+          result.concat(merge_dynamic(buffer))
+          buffer = []
+          result << compile(exps.shift)
+        end
+      end
+      result.concat(merge_dynamic(buffer))
+
+      result.size == 2 ? result[1] : result
+    end
+
+    private
+
+    def merge_dynamic(exps)
+      # Merge exps only when they have both :static and :dynamic
+      unless exps.any? { |type,| type == :static } && exps.any? { |type,| type == :dynamic }
+        return exps
+      end
+
+      strlit_body = String.new
+      exps.each do |type, arg|
+        case type
+        when :static
+          strlit_body << arg.dump.sub!(/\A"/, '').sub!(/"\z/, '').gsub('\n', "\n")
+        when :dynamic
+          strlit_body << "\#{#{arg}}"
+        when :newline
+          # newline is added by `gsub('\n', "\n")`
+        else
+          raise "unexpected type #{type.inspect} is given to #merge_dynamic"
+        end
+      end
+      [[:dynamic, "%Q\0#{strlit_body}\0"]]
+    end
+
+    def count_newline(exps)
+      count = 0
+      exps.each do |exp|
+        if exp == [:newline]
+          count += 1
+        else
+          return count
+        end
+      end
+      return count
+    end
+  end
+end

data/bundle/ruby/3.1.0/gems/haml-6.4.0/lib/haml/engine.rb

@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+require 'temple'
+require 'haml/parser'
+require 'haml/compiler'
+require 'haml/html'
+require 'haml/string_splitter'
+require 'haml/escape'
+require 'haml/escape_any'
+require 'haml/force_escape'
+require 'haml/dynamic_merger'
+require 'haml/ambles'
+require 'haml/whitespace'
+
+module Haml
+  class Engine < Temple::Engine
+    define_options(
+      :buffer_class,
+      generator:    Temple::Generators::StringBuffer,
+      format:       :html,
+      attr_quote:   "'",
+      escape_html:  true,
+      escape_attrs: true,
+      autoclose:    %w(area base basefont br col command embed frame
+                       hr img input isindex keygen link menuitem meta
+                       param source track wbr),
+      filename:     "",
+      disable_capture: false,
+      remove_whitespace: false,
+    )
+
+    use Parser
+    use Compiler
+    use HTML
+    use StringSplitter
+    filter :StaticAnalyzer
+    use Escape
+    use EscapeAny
+    use ForceEscape
+    filter :ControlFlow
+    use Ambles
+    filter :MultiFlattener
+    use Whitespace
+    filter :StaticMerger
+    use DynamicMerger
+    use :Generator, -> { options[:generator] }
+  end
+
+  # For backward compatibility of Tilt integration. TODO: We should deprecate this
+  # and let Tilt have a native support of Haml 6. At least it generates warnings now.
+  class TempleEngine < Engine
+    def compile(template)
+      @precompiled = call(template)
+    end
+
+    def precompiled_with_ambles(_local_names, after_preamble:)
+      "#{after_preamble.tr("\n", ';')}#{@precompiled}".dup
+    end
+  end
+end